2 lines
5.1 KiB
JSON
2 lines
5.1 KiB
JSON
{"affected":[{"affectedData":[{"product":"dovecot","vendor":"[UNKNOWN]","versions":[{"status":"affected","version":"dovecot 2.2.29"}]}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A0F511-D72E-464A-BA7B-477C9CC0B479","versionEndIncluding":"2.2.28","versionStartIncluding":"2.2.26","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang."},{"lang":"es","value":"Dovecot en versiones anteriores a la 2.2.29 es vulnerable a una denegación de servicio (DoS). Cuando se emplearon los \"dict\" passdb y userdb para la autenticación de usuarios, el nombre de usuario enviado por el cliente IMAP/POP3 se envió mediante var_expand() para realizar la expansión de %variable. El envío de campos %variable especialmente manipulados podría resultar en un uso excesivo de memoria que provoca que el proceso se cierre inesperadamente (y se reinicie) o en un uso excesivo de CPU que provoca que todas las autenticaciones dejen de responder."}],"id":"CVE-2017-2669","lastModified":"2026-06-17T01:16:37.520","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.0"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-06-21T13:29:00.317","references":[{"source":"secalert@redhat.com","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2017/04/11/1"},{"source":"secalert@redhat.com","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/97536"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2669"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://dovecot.org/pipermail/dovecot-news/2017-April/000341.html"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b42735.patch"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://www.debian.org/security/2017/dsa-3828"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2017/04/11/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/97536"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2669"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://dovecot.org/pipermail/dovecot-news/2017-April/000341.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b42735.patch"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.debian.org/security/2017/dsa-3828"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"nvd@nist.gov","type":"Primary"}]}
|